Cloudflare OS Launch

Kenton Varda, the Cloudflare engineer behind Cloudflare OS's sandboxing model, has been direct about where the idea comes from: a decade ago he founded Sandstorm.io around the principle that every document or app instance should get its own fully isolated sandbox - a 'Grain' - rather than a slot in a shared multi-tenant server. Cloudflare OS's 'Gadget,' its term for one instance of an app, is explicitly that same idea, now rebuilt on Cloudflare's own infrastructure: each Gadget loads client-side UI and server-side logic on demand as a Dynamic Worker, instantiated inside a Durable Object Facet - a new Workers-runtime primitive Cloudflare built specifically for this project ^[1]. Cloudflare frames the broader workspace the same way internally: an agent and workspace built around how a specific company works, what it knows, and the systems it depends on ^[2].

The security design at Cloudflare OS's core inverts how most internal AI tools handle access. Rather than handing an agent a standalone API key it can use to reach a CRM, ticketing system, or internal codebase, every internal system is fronted by a per-service 'Gatekeeper' Worker that grants scoped, policy-governed access - and agents start with zero permissions by default until a Gatekeeper explicitly grants them ^[3]. Cloudflare's CIO, Sam Rhea, has framed this as a response to a scaling problem: handing raw credentials to autonomous agents is dangerous and doesn't hold up as agent use multiplies, so the security had to live inside the platform itself rather than depend on every individual developer implementing it correctly ^[4]. The approach echoes a related Cloudflare proposal, the Agent Access Model, under which an agent can only do what the human operating it is already permitted to do - never more, and never through a standing account of its own ^[5].

Cloudflare OS's code is Apache 2.0 licensed and free to self-host, but that openness comes with a catch reviewers have been quick to flag: the platform is built around Cloudflare Workers and Durable Objects, so running it still means running on Cloudflare's edge infrastructure rather than a fully neutral stack ^[4]. Security researchers reviewing the release have separately warned that once agents can generate and share their own apps and dashboards, restricted data can leak sideways - through an export, a shared workspace, or an agent-built tool nobody audited ^[3]. Early technical audiences have generally been impressed by the Gatekeeper credential-broker design and its Sandstorm.io lineage, while more skeptical corners of the developer community have pushed back on the 'operating system' framing itself and questioned how much independence the open-source license really buys an adopter tied to Cloudflare's runtime. By shipping the whole stack - workspace, governance, and app layer - under a permissive license, Cloudflare is also positioning it as a free alternative to proprietary enterprise agent platforms, raising the bar for vendors selling comparable governance layers ^[6].

Cloudflare OS wasn't built for outside customers first. CEO Matthew Prince says the company built it because nothing on the market did what Cloudflare itself needed, and only after running it internally did the company decide any organization could 'start from where it took us years to get' ^[6]. Cloudflare gave every employee - thousands of people across every function - access to the first internal version back in May 2026, months before the public open-source release on August 5 during the company's 'Agents Week' ^[7]. The stated goal is removing the 'developer bottleneck': letting non-engineers build, modify, and share working internal apps themselves instead of filing a feature request and waiting on an engineering team ^[2]. Launch partners Presidio ^[8]and Happy Cog ^[9]are already helping enterprises customize deployments, and on GitHub the core repository had already picked up roughly 4.8k stars, 360 forks, and 627 commits within its first stretch as a public project ^[10]. Cloudflare says a fully managed dashboard version, development-workflow containers, and Slack/chat integrations are next ^[6].